High Severity

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure

Labels

Description

Detects messages containing links to Cloudflare Workers domains that follow naming patterns designed to impersonate legitimate services such as Adobe, DocuSign, OneDrive, SharePoint, and voicemail systems. These domains use suspicious alphanumeric identifiers and may be used to deceive recipients into believing they are accessing trusted services.

References

No references.

Sublime Security

Created Apr 6th, 2026 • Last updated Apr 6th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(body.links,
        // eviltokens cloudflare workers domain struct
        (
          strings.iends_with(.href_url.domain.domain, '-account.workers.dev')
          and regex.icontains(.href_url.domain.domain,
                              '^(?:(?:page-)?adobe|calendar_invite|(?:page-)?docusign|fax|quarantine|onedrive|page-password|sharepoint|voicemail|index)-[a-z0-9]{3}\.[a-z0-9-]{3,}'
          )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started